If you’re not PCI compliant, your payment processor will start charging you a monthly non-compliance fee, the card brands can assess fines that escalate into tens of thousands of dollars per month, your acquiring bank can terminate your merchant account and place you on an industry blacklist for five years, and any data breach that occurs while you’re out of compliance opens the door to forensic investigation costs, card reissuance liability, federal and state enforcement, and class-action lawsuits. The Payment Card Industry Data Security Standard is the security framework every business accepting card payments must follow, and the consequences of falling out of compliance stack on top of each other the longer the gap persists.
Monthly Non-Compliance Fees
The first sign of trouble usually shows up on your processing statement. Payment processors add a recurring non-compliance fee, typically $20 to $100 per month for small and mid-sized businesses, when your compliance documentation is overdue. The exact amount varies by processor, transaction volume, and how long you’ve been out of compliance.
These fees are a nudge rather than a penalty. They cover the processor’s cost of carrying a merchant whose security posture is unverified, and for most small businesses the yearly total exceeds what it would cost to complete a Self-Assessment Questionnaire and run the required scans. The problem isn’t the fee itself. It’s that the charge signals to your processor that bigger problems may be coming, and it’s often the only warning before harder consequences arrive.
Card Brand Fines
Visa, Mastercard, and the other major card brands impose a separate and much steeper layer of penalties for sustained non-compliance. These fines are assessed against your acquiring bank, which passes them straight to you. Amounts start in the range of $5,000 to $10,000 per month during the first few months and climb to $50,000 or even $100,000 per month after six months or more. Larger merchants processing millions of transactions face the upper end of that range.
Visa’s compliance program authorizes non-compliance assessments against acquirers whose merchants fail to meet PCI DSS requirements, and makes clear the acquirer is responsible for paying every assessment.1Visa. Account Information Security (AIS) Program and PCI These fines are not published in a public fee schedule, so most merchants don’t learn the exposure exists until the bill lands. Charges are cumulative and can be assessed per violation rather than per account, meaning a business with several security gaps faces compounding costs.
Losing Your Merchant Account and the MATCH List
When non-compliance persists long enough, or when it leads to a security incident, your acquiring bank can terminate your merchant account outright. Losing the account means you can no longer accept credit or debit cards through that processor. For most businesses that alone is devastating, but the more serious damage comes next.
Terminated merchants are typically placed on the MATCH list (Member Alert to Control High-Risk Merchants), a database maintained by Mastercard and consulted by virtually every payment processor in the industry. Mastercard’s reason codes for MATCH placement include one designated specifically for PCI DSS non-compliance, alongside codes for excessive chargebacks, fraud, and card network rule violations. Once you’re on the list, other processors see it during the application screening process and most will decline to open a new account.
A merchant stays on the MATCH list for five years from the date of placement. There’s no standard appeal process. The original acquiring bank can request removal if the listing was made in error, but that rarely applies when the reason is documented non-compliance. During those five years, a business has to run cash-only, find a high-risk processor willing to take on MATCH-listed merchants at significantly higher rates, or restructure entirely.
What a Breach Costs When You Were Non-Compliant
A data breach that occurs while you’re out of compliance triggers an entirely different tier of consequences. The card brands require a PCI Forensic Investigation, performed by an investigator qualified through the PCI Security Standards Council’s program.2PCI Security Standards Council. PCI Forensic Investigator Program Guide You pay for the investigation. Costs typically run from $25,000 to $200,000 or more depending on the scope of the breach, the number of systems involved, and how long the compromise went undetected.
You’re also liable for card reissuance. When compromised card numbers have to be replaced, issuing banks bear the upfront cost of printing and mailing new cards, then recover those costs from you through the card brand’s assessment process. Industry estimates put reissuance at $5 to $25 per card, with most issuers reporting figures around $10. A breach involving tens of thousands of cards means a reissuance bill in the six figures.
Reclassification to a Higher Merchant Level
Visa classifies merchants into four levels based on annual transaction volume. Level 4 merchants processing fewer than one million transactions annually can validate compliance with a Self-Assessment Questionnaire and quarterly scans by an Approved Scanning Vendor. Level 1 merchants processing over six million transactions must undergo an annual on-site Report on Compliance conducted by a Qualified Security Assessor.3Visa. Validation of Compliance – Information Security
Any merchant that suffers a data breach can be escalated to a higher validation level regardless of transaction volume.3Visa. Validation of Compliance – Information Security A small business that previously filed a straightforward questionnaire could suddenly need a full QSA-led audit. Professional Report on Compliance assessments run $15,000 to $50,000 depending on the complexity of the cardholder data environment, and the business must pass before it can resume normal processing.
Legal Exposure
Non-compliance opens legal liability on multiple fronts once cardholder data is compromised.
Federal Enforcement
The Federal Trade Commission has authority under Section 5 of the FTC Act to pursue businesses whose data security practices are inadequate. The statute declares unfair or deceptive acts or practices in commerce unlawful, and the FTC has repeatedly used this authority against companies that failed to protect consumer data.4Office of the Law Revision Counsel. United States Code Title 15 – Section 45 A documented failure to meet PCI DSS strengthens any FTC action because the business couldn’t meet the baseline security standard its own industry established.
State Breach Notification Laws
All 50 states, the District of Columbia, and several U.S. territories have laws requiring businesses to notify individuals when their personal information is compromised.5National Conference of State Legislatures. Summary Security Breach Notification Laws Many impose penalties for delayed notification or insufficient security practices. A growing number of states have enacted broader consumer privacy statutes with per-violation fines that can reach several thousand dollars per affected record, with higher amounts for intentional violations. When compromised records run into the thousands, statutory penalties compound quickly.
Civil Litigation
Affected consumers frequently file class-action lawsuits after a breach, seeking damages for identity theft, fraudulent charges, and the time spent dealing with the aftermath. Non-compliance with PCI DSS serves as powerful evidence of negligence. The business has to explain why it wasn’t meeting the minimum security standard the payment card industry requires of every participant, and evidence that management knew about the non-compliant status and ignored it makes that defense harder still.
Cyber Insurance Usually Won’t Cover You
Many businesses assume their cyber liability insurance will absorb breach-related costs. Non-compliance undermines that assumption in several ways. Standard cyber liability policies do not automatically cover PCI fines and assessments. Unless coverage for card brand penalties is explicitly written into the policy, claims for those costs will likely be denied.
Insurers also commonly include contractual liability exclusions that block coverage for costs stemming from a merchant’s agreement with its acquiring bank, such as fraud loss recovery and operational reimbursement. In one well-known case, an insurer denied a restaurant chain’s $1.9 million claim for PCI assessments because the policy contained a contractual liability exclusion and didn’t explicitly cover card brand penalties.
Non-compliance affects the relationship even before a breach. Most cyber insurers apply sub-limits or exclude PCI fines coverage entirely if the applicant cannot demonstrate current compliance. After a breach, the PCI framework presumes the merchant was non-compliant at the time of compromise, and the burden of proving otherwise falls on the merchant. Businesses that were already non-compliant have virtually no path to shifting breach costs onto their insurer, and they face higher premiums or outright coverage denial going forward.
Getting Back Into Compliance
Returning to compliance is a structured process, and the first step is identifying which Self-Assessment Questionnaire applies to your business. The type depends on how you handle cardholder data. An e-commerce business that fully outsources payment processing to a third party and never touches card data directly completes SAQ A, the simplest form. A business with its own internal network that stores or processes card data falls under SAQ D, which covers the full range of PCI DSS requirements. Several other types sit between these two, each tailored to a specific payment setup.
Preparation involves documenting your network configuration, identifying every third-party service provider that touches your payment environment, and verifying how cardholder data is encrypted and who has access to it. If your business requires quarterly ASV scans, coordinate those early. A failed scan means remediation and rescanning, and that timeline can stretch weeks when vulnerabilities are complex.
Once everything is ready, you submit the completed questionnaire along with an Attestation of Compliance and any required passing scan reports. The Attestation is a formal declaration of your compliance status, submitted to your acquirer or the requesting payment brand.6PCI Security Standards Council. PCI DSS Attestation of Compliance for Onsite Assessments – Merchants Most acquirers provide a secure portal and will update your compliance status in their systems within several business days. Keep a copy of the confirmation. If your processor has been charging a monthly non-compliance fee, that charge should stop once your status is updated, though you may need to follow up to confirm.
For businesses escalated to a higher merchant level after a breach, the path back is steeper. Instead of a self-assessment, you need a Qualified Security Assessor to conduct a formal on-site audit and produce a Report on Compliance.7PCI Security Standards Council. PCI Data Security Standard Report on Compliance Template Budget $15,000 to $50,000 for a professional QSA engagement, depending on the size and complexity of your cardholder data environment. The cost is a fraction of what a second breach or continued non-compliance would cost in fines, legal fees, and lost processing capability.